A compliance signal is a data point an application uses to satisfy a legal, regulatory, or internal policy requirement. It is usually narrower than the full personal data behind it. For example, an app may only need an age category, a region, or a device trust status to decide whether to allow access, restrict a feature, or trigger extra checks.
In cyber security, compliance signals matter because they reduce data collection while still supporting policy enforcement. That can lower exposure if the app is breached, but only if developers handle the signal correctly: store it briefly, protect it in transit, and avoid combining it with other fields that reveal more than intended. Attackers may try to spoof, replay, or harvest such signals to bypass controls or profile users. Defenders therefore treat compliance signals as security-relevant inputs and verify their source, scope, and lifetime.